---
title: SAIF.Framework.Core operations and processes
summary: Business and technical operations supported by this library.
status: draft
owner: <owner>
last_reviewed: 2026-09-15
library: SAIF.Framework.Core
reference_type: package
---

# SAIF.Framework.Core operations and processes

This page is the operation catalog and cross-operation hub for this library. Each operation's detailed, step-by-step logic lives in its own page under `operations/`.

## Operation catalog

| Operation | Intent | Trigger | Inputs | Outputs | Rules |
| --- | --- | --- | --- | --- | --- |
| [SecurityGroupService.GetMembersByResource](operations/security-group-get-members-by-resource.md) | Resolve the AD member list for an authorization "resource" (AD group) | Consuming application needs the member list for an authorization resource | `resourceName`, optional `ldap`/`domain`, `recurse`, `includeDisabled` | `string[]` of member usernames | [BR-CORE-01](business-rules.md#br-core-01-ad-resource-naming-suffix) |
| [MachineSecurityService.IsAuthorized](operations/machine-security-service-is-authorized.md) | Determine whether a machine account is a member of an AD authorization group | Called by `EnvironmentServiceBase.IsDeveloperMachine` and any consumer needing to authorize a machine account | `machine` (SAM account name), `groupName` (ref), `isResource`, `isProductionResource`, `recurse` | `bool` | [BR-CORE-02](business-rules.md#br-core-02-machine-authorization-group-naming) |
| [EnvironmentServiceBase.IsDeveloperMachine](operations/environment-service-is-developer-machine.md) | Gate developer-only configuration behavior based on hostname and AD group membership | Read by numerous callers deciding whether developer-only overrides apply | (none — reads local hostname) | `bool` (cached per instance) | [BR-CORE-03](business-rules.md#br-core-03-developer-machine-hostname-gate) |
| [EnvironmentServiceBase.GetConfigSettingInfo](operations/environment-service-get-config-setting-info.md) | Resolve a configuration key through layered precedence (developer override → cache → Environment API) | Every `IEnvironmentService.GetConfigSetting(...)` invocation | `configKey` | Resolved `ConfigSetting` value | [BR-CORE-04](business-rules.md#br-core-04-developer-settings-override-precedence) |
| [PdfConvertAndMergeService.ConvertAysnc / MergeAysnc](operations/pdf-convert-and-merge-service-convert-merge.md) | Schedule a file for conversion or merge by the external activePDF-hosted process | Application requests PDF conversion or merge | Raw file bytes/name or `MergeFileItem` list, `applicationCode`, optional `sourceSystemId`/`ImageConfig` | `PdfTrackingResult` (tracking id, optional reserved image id) | — |
| [SecurityApiClient.GetUser / IsAuthorized](operations/security-api-client-get-user-is-authorized.md) | Retrieve a user profile or authorization decision from the REST Security API | Consumer needs a user profile or authorization decision via REST | `domainUsername` or `username`+`role` | `UserProfile` or `bool` | [BR-CORE-05](business-rules.md#br-core-05-security-api-username-format-requirement), [BR-CORE-06](business-rules.md#br-core-06-rest-role-name-suffix-normalization), [BR-CORE-12](business-rules.md#br-core-12-security-api-request-pre-validation) |
| [FluentValidationService.Validate / ValidateAndThrow](operations/fluent-validation-service-validate.md) | Validate a DTO/entity against its FluentValidation rules, plus the authorization rule set | Any consumer needing to validate a DTO/entity | Entity instance of type `T` | `ValidationResult` (or exception via `ValidateAndThrow`) | [BR-CORE-11](business-rules.md#br-core-11-authorizationrules-side-effect-execution) |
| [FaxService.SendFax](operations/fax-service-send-fax.md) | Validate and submit a fax job | Application requests a fax be sent | `FaxConfig` (file, recipients) | Validation result / fax submission | [BR-CORE-07](business-rules.md#br-core-07-fax-file-required), [BR-CORE-08](business-rules.md#br-core-08-fax-recipients-required), [BR-CORE-09](business-rules.md#br-core-09-fax-recipient-fax-number-required), [BR-CORE-10](business-rules.md#br-core-10-fax-recipient-name-required) |
| [ServiceRegistrations.RegisterCoreServicesForWeb / RegisterCoreServicesForWindows](operations/service-registrations-register-core-services.md) | Wire this library's platform services into a consuming application's Autofac container | Called once at application startup | `ContainerBuilder`, optional `currentUserId` (Windows) | Populated `ContainerBuilder` registrations | — |

## Process flow diagram
The following diagram visualizes the primary authorization-resolution flow spanning several of the operations above.

```mermaid
flowchart TD
	Start([Caller requests AD resource members]) --> GetMembers[SecurityGroupService.GetMembersByResource]
	GetMembers --> Normalize[Normalize Resource/TestResource suffix]
	Normalize --> WCFCall[SecurityServiceClient.GetUsersByGroup]
	WCFCall --> EndOk([Return member usernames])

	StartDev([Any GetConfigSetting call]) --> DevCheck{IsDeveloperMachine?}
	DevCheck -->|check hostname pattern| TagCheck{Hostname matches T/V + digits?}
	TagCheck -->|No| NotDev([Not a developer machine])
	TagCheck -->|Yes| MachineAuth[MachineSecurityService.IsAuthorized]
	MachineAuth --> ADLookup[ADService.GetUsersByGroup]
	ADLookup --> DevResult([Developer machine true/false])
```

## Database interactions

No database interactions were identified for the operations on this page — see [Configuration](configuration.md) for the two generic database-connection resolutions (`DbConnectionManager`) that are configuration/connection-string concerns, not SQL operations, and [Dependencies](dependencies.md) for the one repository-based usage pattern (`PdfConvertAndMergeService`) that reads/writes `PDFTracking`/`PDFApplicationErrorCode`/`PDFTrackingCode`/`PDFStatusCode` through the generic `IUnitOfWork`/`IRepository<T>` abstraction with no SQL text authored in this library.

## Failure and edge-case behavior
- `SecurityGroupService.GetMembersByResource` has no explicit error handling; WCF `FaultException`/`CommunicationException` propagate to the caller.
- `MachineSecurityService.IsAuthorized` catches any exception internally, writes it to `Debug.WriteLine`, and swallows it — an explicit fail-closed behavior where `found` remains `false` and no exception propagates to the caller.
- `EnvironmentServiceBase.IsDeveloperMachine` short-circuits to `false` with no AD call at all when the hostname does not match the tag-number pattern.
- `SecurityApiClient.GetUser`/`IsAuthorized` throw `ArgumentException`/`ArgumentNullException` before any network call when the `domain\username` format is invalid.
- `FluentValidationService.Validate<T>(T)` always additionally executes the `"AuthorizationRules"` rule set but discards its result — see [BR-CORE-11](business-rules.md#br-core-11-authorizationrules-side-effect-execution).

## Related documentation
- [Index](index.md)
- [Overview](overview.md)
- [Architecture](architecture.md)
- [Dependencies](dependencies.md)
- [Configuration](configuration.md)
- [Business rules](business-rules.md)
- [Security and authorization](security-authorization.md)
- [API reference](api/index.md)

## Sources
- `Services\SecurityGroupService.cs`
- `Core\Services\MachineSecurityService.cs`
- `Core\Services\ADService.cs`
- `Services.Common\EnvironmentServiceBase.cs`
- `Services\Utilities\Documents\PdfConvertAndMergeService.cs`
- `Services\Utilities\SecurityApiClient.cs`
- `Services\Utilities\FluentValidationService.cs`
- `Services\Utilities\Documents\FaxService.cs`
- `Services\ServiceRegistrations.cs`